UCSF IT Technology

Cybercriminals have started using the URL shortening service clck[.]ru in widespread phishing attacks in April. The nature of these attacks and the lures used vary greatly. However, the attacks encourage recipients to click on a shortened URL ending in [.]ru.

Cybercriminals have launched Okta-branded phishing attacks encouraging recipients to follow a link to resynchronize their Okta and Microsoft accounts.   Clicking on the link leads to a credential phishing kit that redirects the user to a lookalike Microsoft login page.

Cybercriminals have launched series of phishing attacks claiming to be from the recipient’s HR department.The lures use a variety of sender names like HR Alerts or HR Department; however, the actual sending address is not associated with a recipient’s company or HR department.The lures typically direct the recipient to take immediate action regarding an HR assignment or alert by clicking on a malicious link leading to the download of a zipped .url file or downloading a PDF attachment.